{
  "id": 7516913,
  "title": "UAE Central Bank redraws operational risk management rules for financial sector",
  "url": "https://urgent.news/2026/09/15/uae-central-bank-redraws-operational-risk-management-rules-for",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-09-15T08:52:05.000Z",
  "source": {
    "name": "Gulf News",
    "slug": "gulf-news",
    "url": "https://gulfnews.com/business/banking/uae-central-bank-redraws-operational-risk-management-rules-for-financial-sector-1.500675080"
  },
  "original_language": "en",
  "account": "The Central Bank of the UAE has introduced new regulations to overhaul the operational risk management approach in the financial sector, effective from September 14, 2026. The new Regulation No. C 1/2026 supersedes the previous Circular No. 163/2018, aiming to enhance the sector's ability to withstand and recover from disruptions, adapt to the evolving risk landscape, and incorporate cybersecurity into its core risk framework.\n\nThe regulation establishes a framework based on the three lines of defence model. The first line is comprised of business units that identify and control risks. The second line consists of risk management and compliance functions that provide independent oversight, while the third line is internal audit that offers assurance on the effectiveness of the institution's risk management framework.\n\nA key feature of the new regulation is the emphasis on operational resilience, which is crucial in the current era of digital transformation and increasing cyber threats. Financial institutions must now engage in periodic operational risk stress tests, including control environment testing and penetration testing, to assess their ability to withstand real-life disruption scenarios. Additionally, institutions must conduct penetration tests by independent external parties for critical functions.\n\nReporting of major incidents requiring a significant impact on critical operations has also been tightened, with a mandatory notification to the Central Bank within four hours of such an event, followed by a detailed report within 24 hours. This swift reporting mechanism ensures that the Central Bank is informed promptly of potential disruptions to the financial sector.\n\nIn essence, these new regulations move the UAE financial sector from a reactive stance towards risk prevention to a proactive stance focused on maintaining operational continuity, adapting to changing risks, and fostering resilience in the face of disruptions.",
  "summary": "The new Operational Risk Management Regulation issued by the Central Bank of the UAE came into effect on September 14, 2026, marking a significant regulatory shift in how the UAE’s financial sector approaches risk — moving beyond the traditional focus on preventing operational losses towards building institutions capable of continuing operations, adapting, recovering and learning from…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 3,
    "also_reported_by": [
      {
        "outlet": "Gulf News",
        "title": "New UAE Central Bank rules target outages, fraud and cyberattacks",
        "url": "https://urgent.news/2026/09/15/new-uae-central-bank-rules-target-outages-fraud-and-cyberattacks",
        "published": "2026-09-15T07:02:23.000Z"
      },
      {
        "outlet": "Arabian Business",
        "title": "UAE Central Bank targets banking apps and card disruption with tougher risk rules",
        "url": "https://urgent.news/2026/09/15/uae-central-bank-targets-banking-apps-and-card-disruption-with",
        "published": "2026-09-15T09:03:55.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}